Fortinet white logo
Fortinet white logo

Administration Guide

Create or edit an authentication rule

Create or edit an authentication rule

To create an authentication rule:
  1. In the authentication rule list, select Create New > Authentication Rules from the toolbar.

  2. Configure the following:

    Name

    The name of the authentication rule.

    Protocol

    Select which protocol is matched for the rule.

    Source Interface

    Select the source interface for the rule.

    Web Proxy

    Select the web proxy for the rule.

    Source Address

    Select the source IPv4 addresses, address groups, all, or none. Required for web-proxy authentication.

    Source IPv6 Address

    Select the source IPv6 address or address groups, all, or none. Required for web-proxy authentication.

    Destination IPv6 Address

    The destination IPv6 addresses, address groups, all, or none.

    Destination Address

    The destination IPv4 addresses, address groups, all, or none.

    Authentication Scheme

    Enable Authentication Scheme to use an authentication scheme and then select which authentication scheme to use.

    To create an authentication scheme, see Create or edit an authentication scheme.

    IP-based Authentication

    Select Enable if you want to use IP-based authentication.

    SSO Authentication Scheme

    If you selected Enable for IP-based authentication, enable SSO Authentication Scheme if you want to use single sign-on method and then select which single sign-on method to use.

    Comments

    Enter an optional description of the rule.

    Enable This Rule

    Select Enable or Disable to control whether the authentication rule is used or ignored.

    API Preview

    The API Preview allows you to view all REST API requests being used by the page. You can make changes on the page that are reflected in the API request preview. This feature is not available if the user is logged in as an administrator that has read-only GUI permissions.

  3. Click OK to create the new authentication rule.

To use the API Preview:
  1. Click API Preview. The API Preview pane opens, and the values for the fields are visible (data). If a new object is being created, the POST request is shown.

  2. Enable Show modified changes only to show the modified changes instead of the full configuration in the preview.

  3. Click Copy to Clipboard to copy the JSON code shown on the preview screen to the clipboard.

  4. Click Close to leave the preview.

To edit an authentication rule:
  1. Select the authentication rule you want to edit and then click Edit from the toolbar or double-click on the rule in the rule table.

  2. Edit the rule information as required and click OK to apply your changes.

To set the authentication rule in the CLI:

config authentication rule

edit <name of rule>

set status [enable|disable]

set protocol [http|ftp|socks|ssh]

set web-proxy <explicit_proxy_entity>

set srcintf <name of incoming (ingress) interface>

set srcaddr <name of IPv4 source address>

set dstaddr <name of IPv4 destination address>

set srcaddr6 <name of address object>

set ip-based [enable|disable]

set active-auth-method <string>

set sso-auth-method <string>

set web-auth-cookie [enable|disable]

set transaction-based [enable|disable]

set web-portal [enable|disable]

set comments <string>

next

end

Refer to config authentication rule in the CLI guide for more information.

Create or edit an authentication rule

Create or edit an authentication rule

To create an authentication rule:
  1. In the authentication rule list, select Create New > Authentication Rules from the toolbar.

  2. Configure the following:

    Name

    The name of the authentication rule.

    Protocol

    Select which protocol is matched for the rule.

    Source Interface

    Select the source interface for the rule.

    Web Proxy

    Select the web proxy for the rule.

    Source Address

    Select the source IPv4 addresses, address groups, all, or none. Required for web-proxy authentication.

    Source IPv6 Address

    Select the source IPv6 address or address groups, all, or none. Required for web-proxy authentication.

    Destination IPv6 Address

    The destination IPv6 addresses, address groups, all, or none.

    Destination Address

    The destination IPv4 addresses, address groups, all, or none.

    Authentication Scheme

    Enable Authentication Scheme to use an authentication scheme and then select which authentication scheme to use.

    To create an authentication scheme, see Create or edit an authentication scheme.

    IP-based Authentication

    Select Enable if you want to use IP-based authentication.

    SSO Authentication Scheme

    If you selected Enable for IP-based authentication, enable SSO Authentication Scheme if you want to use single sign-on method and then select which single sign-on method to use.

    Comments

    Enter an optional description of the rule.

    Enable This Rule

    Select Enable or Disable to control whether the authentication rule is used or ignored.

    API Preview

    The API Preview allows you to view all REST API requests being used by the page. You can make changes on the page that are reflected in the API request preview. This feature is not available if the user is logged in as an administrator that has read-only GUI permissions.

  3. Click OK to create the new authentication rule.

To use the API Preview:
  1. Click API Preview. The API Preview pane opens, and the values for the fields are visible (data). If a new object is being created, the POST request is shown.

  2. Enable Show modified changes only to show the modified changes instead of the full configuration in the preview.

  3. Click Copy to Clipboard to copy the JSON code shown on the preview screen to the clipboard.

  4. Click Close to leave the preview.

To edit an authentication rule:
  1. Select the authentication rule you want to edit and then click Edit from the toolbar or double-click on the rule in the rule table.

  2. Edit the rule information as required and click OK to apply your changes.

To set the authentication rule in the CLI:

config authentication rule

edit <name of rule>

set status [enable|disable]

set protocol [http|ftp|socks|ssh]

set web-proxy <explicit_proxy_entity>

set srcintf <name of incoming (ingress) interface>

set srcaddr <name of IPv4 source address>

set dstaddr <name of IPv4 destination address>

set srcaddr6 <name of address object>

set ip-based [enable|disable]

set active-auth-method <string>

set sso-auth-method <string>

set web-auth-cookie [enable|disable]

set transaction-based [enable|disable]

set web-portal [enable|disable]

set comments <string>

next

end

Refer to config authentication rule in the CLI guide for more information.